Roles, permissions, and RBAC

EDGE Sword separates modules (what features exist) from permissions (what a user may do).

Please note:

• A user never sees a module disabled for the tenant, even if their role includes related permissions — enable modules under Enable and manage modules or the Configure your workspace walkthrough.
• Run periodic access reviews with the Workspace security checklist after role changes.

Modules vs permissions

Concept	Controls
Enabled modules	Whether a feature appears for the tenant
Role permissions	Whether a user can read, write, or administer inside that feature

flowchart TB
  Tenant[Tenant workspace] --> Modules[Enabled modules]
  Tenant --> Roles[Roles]
  Roles --> Perms[Permissions resource.action]
  Modules --> Nav[Navigation and features]
  Perms --> Actions[Allowed actions inside modules]
  Nav --> User[What the user sees]
  Actions --> User

A user never sees a module that is disabled for the tenant, even if their role includes related permissions.

Permission shape

Permissions look like resource.action — for example customers.read or pos.kitchen. Admins receive broad access via the admin role.

Scope style	Meaning
read	All records the role can access in that resource
read_own	Only records owned by the user
read_team	Records owned by the user's team

Assign roles

1. Open Settings → Roles & Permissions — see Roles in Settings for the full UI
2. Create or edit a role and select permissions
3. Assign the role to members under Manage members

Use least privilege: grant only what each job needs. Set each role's default landing page under Start modules per role after permissions are defined. Pair this guide with the Workspace security checklist for periodic reviews. New members should be invited via Add users and invite teammates with the smallest viable role.